CVE-2024-42484

ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An Out-of-Bound OOB vulnerability was discovered in the implementation of the ESP-NOW group type message because there is no check for the addrsnum field of the group type message. This can result in memory corruption relat...

CVE-2024-7269

Improper Neutralization of Input During Web Page Generation vulnerability in "Update of Personal Details" form in ConnX ESP HR Management allows Stored XSS attack. An attacker might inject a script to be run in user's browser. After multiple attempts to contact the vendor we did not receive any...

CVE-2024-28183

ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use TOCTOU vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass...

CVE-2023-0246

A vulnerability, which was classified as problematic, was found in earclink ESPCMS P8.21120101. Affected is an unknown function of the component Content Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2021-28135

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service crash in ESP32 by flooding the target device with LMP Feature Response data...

CVE-2020-13595

The Bluetooth Low Energy BLE controller implementation in Espressif ESP-IDF 4.0 through 4.2 for ESP32 devices returns the wrong number of completed BLE packets and triggers a reachable assertion on the host stack when receiving a packet with an MIC failure. An attacker within radio range can...

CVE-2020-16146

Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buffer Overflow in BluFi provisioning in btcblufirecvhandler function in blufiprf.c. An attacker can send a crafted BluFi protocol Write Attribute command to...

CVE-2019-15894

An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code fr...

CVE-2025-46419

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet...

CVE-2025-46419

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet...

PT-2025-17681 · Westermo · Weos

Name of the Vulnerable Software and Affected Versions: Westermo WeOS versions 5 through 5.23.0 Description: The issue allows for a reboot via a malformed ESP packet. Recommendations: For Westermo WeOS versions 5 through 5.23.0, update to a version later than 5.23.0 to resolve the issue...

CVE-2025-46419

Westermo WeOS 5.x (versions 5 through 5.23.0) is affected. When IPSec is configured, processing of a malformed ESP packet can trigger an immediate device reboot, constituting a denial-of-service condition. The vulnerability’s CVSSv3.1 base metrics indicate NETWORK access, high attack complexity, ...

CVE-2025-46419

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet...

CVE-2025-46419

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet...

CVE-2025-46419: Improper Validation of Syntactic Correctness of Input

Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet...

CVE-2024-53406

Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks...

CVE-2024-53406

Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks...

PT-2025-11193

Name of the Vulnerable Software and Affected Versions: Espressif Esp idf version 5.3.0 Description: The issue is related to Insecure Permissions, which results in Authentication bypass. Specifically, during the reconnection phase, the device reuses the session key from a previous connection...

CVE-2024-53406: Authorization Bypass Through User-Controlled Key

Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass. In the reconnection phase, the device reuses the session key from a previous connection session, creating an opportunity for attackers to execute security bypass attacks...

CVE-2025-27579

In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address aka stratumUser for a Bitaxe Bitcoin miner, or change the frequency and voltage settings...